sweetome.com Listed by lockbit5 Ransomware Group

On June 10, 2026, the ransomware group LockBit5 added sweetome.com to its public leak site, confirming that it had exfiltrated internal files from the operator of a hotel chain brand and real estate operation and management services provider.

Confirmed Facts from Reporting

Public reporting indicates the incident stems from a ransomware attack in which LockBit5 claims to have stolen company documents before encrypting systems. The leak site entry lists the victim as sweetome.com and shows samples of the allegedly stolen material. No exact count of affected individuals has been disclosed, and the precise volume or sensitivity of the files remains unconfirmed by the company in available reporting. The posting appeared on the LockBit5 onion site, which is tracked by ransomware monitoring services such as ransomware.live.

Why This Matters for You and Your Family

When a company that manages hotels and real estate properties loses control of internal files, the information inside can easily include guest records, vendor contracts, employee details, or even tenant and homeowner personal data. If your family has stayed at one of the chain’s properties, booked through its platforms, or used its real estate services, your contact information, payment details, or identification documents may now sit in an attacker’s archive. Credential leaks like this one frequently cascade into account takeovers on other sites where the same email and password are reused. For families, that risk extends to children’s accounts tied to the same household email or phone number.

The Doxxing and Identity-Chain Implications

Stolen internal files often contain spreadsheets that link names, addresses, phone numbers, email accounts, and sometimes dates of birth. Attackers and subsequent data resellers can combine these details with information already circulating on underground forums. The result is an identity chain: one exposed email leads to a reused password on a gaming platform, a hotel loyalty account, or a family member’s social media. Public reporting describes how such chains enable doxxing, targeted phishing, and eventual extortion attempts against individuals rather than the company. Children’s gaming accounts are particularly vulnerable because they frequently share household contact details and lack adult-level security settings.

LockBit5’s Publicly Known Track Record

Public reporting attributes LockBit5 as the latest iteration of the LockBit ransomware operation, which first emerged in 2019 and has repeatedly rebranded after law enforcement actions. The group has targeted hospitals, manufacturers, financial firms, and service providers worldwide. Its typical playbook involves gaining initial access through phishing, remote desktop protocol weaknesses, or stolen credentials, followed by rapid exfiltration of sensitive files. The operators then deploy ransomware to encrypt systems and demand payment, publishing samples and eventually the full dataset on their leak site if the victim does not pay. Extortion tactics include direct threats to employees and partners in addition to public shaming on the dark web.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what this breach connects to.
• Rotate any password you used on sweetome.com or its related hotel and real estate portals anywhere else it appears, and switch to 2FA through an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours rather than months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts which often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles that surface from this incident.

The speed with which ransomware groups move stolen data means families cannot afford to wait for official notifications. Starting with a clear map of your exposed information and putting continuous oversight in place gives you the best chance of stopping the next stage of the attack before it reaches your doorstep. DoxxScan by GalaxyWarden delivers that combination of continuous monitoring across 15.4B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.